AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix handling of potential string additions in hydrogen.

Browse Source 
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3476
BUG=v8:3476
LOG=N

Review URL: https://codereview.chromium.org/423083004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2014-07-29 14:53:11 +00:00
parent c0f6b34199
commit 57c315d0b3
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/hydrogen.cc
View File

@ -10240,7 +10240,9 @@ HValue* HGraphBuilder::BuildBinaryOperation(
bool maybe_string_add = op == Token::ADD &&
(left_type->Maybe(Type::String()) ||
right_type->Maybe(Type::String()));
left_type->Maybe(Type::Receiver()) ||
right_type->Maybe(Type::String()) ||
right_type->Maybe(Type::Receiver()));
if (left_type->Is(Type::None())) {
Add<HDeoptimize>("Insufficient type feedback for LHS of binary operation",

24
test/mjsunit/regress/regress-3476.js Normal file
View File

@ -0,0 +1,24 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function MyWrapper(v) {
return { valueOf: function() { return v } };
}
function f() {
assertEquals("truex", true + "x");
assertEquals("truey", true + new String("y"));
assertEquals("truez", true + new MyWrapper("z"));
assertEquals("xtrue", "x" + true);
assertEquals("ytrue", new String("y") + true);
assertEquals("ztrue", new MyWrapper("z") + true);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();